gitmole 0.3.0__tar.gz → 0.4.0__tar.gz

{gitmole-0.3.0 → gitmole-0.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gitmole
-Version: 0.3.0
+Version: 0.4.0
 Summary: Offline git repository analysis with a terminal report: hotspots, coupling, ownership, code age, secrets, repo health.
 License: MIT
 Project-URL: Homepage, https://github.com/antvinni/gitmole
@@ -22,11 +22,11 @@ Dynamic: license-file
 
 # gitmole
 
-> A toolkit for digging into any cloned git repository: who works on it,
-> where the risk is, how old the code is, whether the repo itself is healthy,
-> and whether anything sensitive was ever committed.
->
-> Any stack. Free. Offline. No token. No AI. Light.
+A toolkit for digging into any cloned git repository: who works on it,
+where the risk is, how old the code is, whether the repo itself is healthy,
+and whether anything sensitive was ever committed.
+
+Any stack. Free. Offline. No token. No AI. Light.
 
 ## Principles
 
@@ -64,7 +64,7 @@ you about a clone.
 | How old is the surviving code, per year and author | gitmole's own blame pass (one `git blame` per file at HEAD) | built in |
 | Code-age and survival plots over time | [git-of-theseus](https://github.com/erikbern/git-of-theseus) | pip, opt-in with `--plots` |
 | Per-function complexity, length, parameters; duplicated blocks with `--duplicates` | [lizard](https://github.com/terryyin/lizard) | pip, installed with gitmole; tracked code files only |
-| Have secrets ever been committed | [gitleaks](https://github.com/gitleaks/gitleaks) | brew |
+| Have secrets ever been committed | [betterleaks](https://github.com/betterleaks/betterleaks) | brew |
 
 Why these and not others: [docs/tools.md](https://github.com/antvinni/gitmole/blob/main/docs/tools.md).
 
@@ -73,7 +73,7 @@ Why these and not others: [docs/tools.md](https://github.com/antvinni/gitmole/bl
 gitmole needs git, Python 3.9 or newer, and three tools on your PATH:
 [scc](https://github.com/boyter/scc) for size,
 [git-sizer](https://github.com/github/git-sizer) for repository health and
-[gitleaks](https://github.com/gitleaks/gitleaks) for secrets. gitmole itself
+[betterleaks](https://github.com/betterleaks/betterleaks) for secrets. gitmole itself
 is a Python package; install it with [pipx](https://pipx.pypa.io) so it gets
 its own environment and a `gitmole` command.
 
@@ -109,23 +109,23 @@ a static binary, so dropping it into `~/.local/bin` is enough.
 sudo apt install git git-sizer pipx
 pipx ensurepath                                  # once; then open a new shell
 
-# scc and gitleaks: one static binary each, from their release pages
-#   https://github.com/boyter/scc/releases        (the Linux x86_64 or arm64 archive)
-#   https://github.com/gitleaks/gitleaks/releases (the linux x64 or arm64 archive)
+# scc and betterleaks: one static binary each, from their release pages
+#   https://github.com/boyter/scc/releases               (the Linux x86_64 or arm64 archive)
+#   https://github.com/betterleaks/betterleaks/releases (the linux x64 or arm64 archive)
 # unpack and move the binary into ~/.local/bin, then:
-chmod +x ~/.local/bin/scc ~/.local/bin/gitleaks
+chmod +x ~/.local/bin/scc ~/.local/bin/betterleaks
 
 pipx install gitmole
 ```
 
 On a distribution without a `pipx` package, `python3 -m pip install --user
-pipx` installs it. Some distributions package scc or gitleaks as well; if
+pipx` installs it. Some distributions package scc or betterleaks as well; if
 yours does, prefer that to a downloaded binary.
 
 ### Check
 
 ```bash
-scc --version && git-sizer --version && gitleaks version && gitmole --version
+scc --version && git-sizer --version && betterleaks version && gitmole --version
 gitmole .                                        # a report of the clone you are in
 ```
 
@@ -326,8 +326,9 @@ The full report is in [docs/example.md](https://github.com/antvinni/gitmole/blob
    web pages, is a warning. Version strings and tokens shortened with "..."
    cannot be live secrets, so they are left out and counted on the footer
    line. Nothing is skipped by prefix. To silence a false positive for
-   good, copy its fingerprint from `secrets.json` into a `.gitleaksignore`
-   at the repository root; gitleaks reads it on the next run.
+   good, copy its fingerprint from `secrets.json` into a `.betterleaksignore`
+   at the repository root; betterleaks reads it on the next run, and an
+   existing `.gitleaksignore` works too.
 
    A commit counts as a fix when its subject starts with `fix:`, `hotfix:` or
    `bugfix:` in the conventional style, or mentions fix, bug, hotfix,
@@ -387,7 +388,7 @@ The files each run writes, and how to read them: [docs/output.md](https://github
 ## Development
 
 Developer setup: Homebrew for the three tools,
-`brew install scc git-sizer gitleaks`. Then either a virtual environment
+`brew install scc git-sizer betterleaks`. Then either a virtual environment
 with `pip install -e .`, or the checkout style:
 `python3 -m pip install --user rich lizard` and
 `ln -sfn "$PWD/bin/gitmole" "$(brew --prefix)/bin/gitmole"`, which makes
@@ -438,8 +439,8 @@ and `render.py` draws the report. `bin/gitmole` is a thin launcher.
 - Everything here is offline except the optional clone step, which uses
   your existing gh auth. None of the tools send data anywhere.
 - Remote targets are cloned into a fresh temp directory. Local clones are
-  only read, but the log export and the gitleaks scan touch all branches.
-- Secret values never reach the output directory. gitleaks writes its report
+  only read, but the log export and the betterleaks scan touch all branches.
+- Secret values never reach the output directory. betterleaks writes its report
   to gitmole in memory, and gitmole stores a short keyed hash of each value
   in place of the value, the matched text and the commit message. The key is
   random, made for that one report and never saved, so a stored hash cannot
@@ -459,7 +460,7 @@ separate processes. Their licences:
 |---|---|
 | scc | MIT |
 | git-sizer | MIT |
-| gitleaks | MIT |
+| betterleaks | MIT |
 | rich | MIT |
 | lizard | MIT |
 | git-of-theseus | Apache-2.0 |

{gitmole-0.3.0 → gitmole-0.4.0}/README.md

@@ -2,11 +2,11 @@
 
 # gitmole
 
-> A toolkit for digging into any cloned git repository: who works on it,
-> where the risk is, how old the code is, whether the repo itself is healthy,
-> and whether anything sensitive was ever committed.
->
-> Any stack. Free. Offline. No token. No AI. Light.
+A toolkit for digging into any cloned git repository: who works on it,
+where the risk is, how old the code is, whether the repo itself is healthy,
+and whether anything sensitive was ever committed.
+
+Any stack. Free. Offline. No token. No AI. Light.
 
 ## Principles
 
@@ -44,7 +44,7 @@ you about a clone.
 | How old is the surviving code, per year and author | gitmole's own blame pass (one `git blame` per file at HEAD) | built in |
 | Code-age and survival plots over time | [git-of-theseus](https://github.com/erikbern/git-of-theseus) | pip, opt-in with `--plots` |
 | Per-function complexity, length, parameters; duplicated blocks with `--duplicates` | [lizard](https://github.com/terryyin/lizard) | pip, installed with gitmole; tracked code files only |
-| Have secrets ever been committed | [gitleaks](https://github.com/gitleaks/gitleaks) | brew |
+| Have secrets ever been committed | [betterleaks](https://github.com/betterleaks/betterleaks) | brew |
 
 Why these and not others: [docs/tools.md](https://github.com/antvinni/gitmole/blob/main/docs/tools.md).
 
@@ -53,7 +53,7 @@ Why these and not others: [docs/tools.md](https://github.com/antvinni/gitmole/bl
 gitmole needs git, Python 3.9 or newer, and three tools on your PATH:
 [scc](https://github.com/boyter/scc) for size,
 [git-sizer](https://github.com/github/git-sizer) for repository health and
-[gitleaks](https://github.com/gitleaks/gitleaks) for secrets. gitmole itself
+[betterleaks](https://github.com/betterleaks/betterleaks) for secrets. gitmole itself
 is a Python package; install it with [pipx](https://pipx.pypa.io) so it gets
 its own environment and a `gitmole` command.
 
@@ -89,23 +89,23 @@ a static binary, so dropping it into `~/.local/bin` is enough.
 sudo apt install git git-sizer pipx
 pipx ensurepath                                  # once; then open a new shell
 
-# scc and gitleaks: one static binary each, from their release pages
-#   https://github.com/boyter/scc/releases        (the Linux x86_64 or arm64 archive)
-#   https://github.com/gitleaks/gitleaks/releases (the linux x64 or arm64 archive)
+# scc and betterleaks: one static binary each, from their release pages
+#   https://github.com/boyter/scc/releases               (the Linux x86_64 or arm64 archive)
+#   https://github.com/betterleaks/betterleaks/releases (the linux x64 or arm64 archive)
 # unpack and move the binary into ~/.local/bin, then:
-chmod +x ~/.local/bin/scc ~/.local/bin/gitleaks
+chmod +x ~/.local/bin/scc ~/.local/bin/betterleaks
 
 pipx install gitmole
 ```
 
 On a distribution without a `pipx` package, `python3 -m pip install --user
-pipx` installs it. Some distributions package scc or gitleaks as well; if
+pipx` installs it. Some distributions package scc or betterleaks as well; if
 yours does, prefer that to a downloaded binary.
 
 ### Check
 
 ```bash
-scc --version && git-sizer --version && gitleaks version && gitmole --version
+scc --version && git-sizer --version && betterleaks version && gitmole --version
 gitmole .                                        # a report of the clone you are in
 ```
 
@@ -306,8 +306,9 @@ The full report is in [docs/example.md](https://github.com/antvinni/gitmole/blob
    web pages, is a warning. Version strings and tokens shortened with "..."
    cannot be live secrets, so they are left out and counted on the footer
    line. Nothing is skipped by prefix. To silence a false positive for
-   good, copy its fingerprint from `secrets.json` into a `.gitleaksignore`
-   at the repository root; gitleaks reads it on the next run.
+   good, copy its fingerprint from `secrets.json` into a `.betterleaksignore`
+   at the repository root; betterleaks reads it on the next run, and an
+   existing `.gitleaksignore` works too.
 
    A commit counts as a fix when its subject starts with `fix:`, `hotfix:` or
    `bugfix:` in the conventional style, or mentions fix, bug, hotfix,
@@ -367,7 +368,7 @@ The files each run writes, and how to read them: [docs/output.md](https://github
 ## Development
 
 Developer setup: Homebrew for the three tools,
-`brew install scc git-sizer gitleaks`. Then either a virtual environment
+`brew install scc git-sizer betterleaks`. Then either a virtual environment
 with `pip install -e .`, or the checkout style:
 `python3 -m pip install --user rich lizard` and
 `ln -sfn "$PWD/bin/gitmole" "$(brew --prefix)/bin/gitmole"`, which makes
@@ -418,8 +419,8 @@ and `render.py` draws the report. `bin/gitmole` is a thin launcher.
 - Everything here is offline except the optional clone step, which uses
   your existing gh auth. None of the tools send data anywhere.
 - Remote targets are cloned into a fresh temp directory. Local clones are
-  only read, but the log export and the gitleaks scan touch all branches.
-- Secret values never reach the output directory. gitleaks writes its report
+  only read, but the log export and the betterleaks scan touch all branches.
+- Secret values never reach the output directory. betterleaks writes its report
   to gitmole in memory, and gitmole stores a short keyed hash of each value
   in place of the value, the matched text and the commit message. The key is
   random, made for that one report and never saved, so a stored hash cannot
@@ -439,7 +440,7 @@ separate processes. Their licences:
 |---|---|
 | scc | MIT |
 | git-sizer | MIT |
-| gitleaks | MIT |
+| betterleaks | MIT |
 | rich | MIT |
 | lizard | MIT |
 | git-of-theseus | Apache-2.0 |

{gitmole-0.3.0 → gitmole-0.4.0}/gitmole/__init__.py

@@ -1,3 +1,3 @@
 """gitmole: offline git repository analysis with a terminal report."""
 
-__version__ = "0.3.0"
+__version__ = "0.4.0"

{gitmole-0.3.0 → gitmole-0.4.0}/gitmole/cli.py

@@ -95,7 +95,7 @@ def main(argv=None, console: Console = None, tool_check=run.missing_tools, plann
     missing = tool_check(plots=args.plots)
     if missing:
         err.print("[red]missing tools:[/red] " + ", ".join(missing))
-        err.print("brew install scc git-sizer gitleaks; see README.md for other ways")
+        err.print("brew install scc git-sizer betterleaks; see README.md for other ways")
         return 2
     args.lizard = lizard_check()   # decided once, for every repository this run analyses
 

{gitmole-0.3.0 → gitmole-0.4.0}/gitmole/findings.py

@@ -45,7 +45,7 @@ def secrets_found(report: dict) -> list:
     groups = leaks.group(report.get("secrets") or [])
     source = [g for g in groups if not g["test"]]
     tests = [g for g in groups if g["test"]]
-    ignore = "Add the fingerprint of any false positive from secrets.json to .gitleaksignore in the repository."
+    ignore = "Add the fingerprint of any false positive from secrets.json to .betterleaksignore in the repository."
     out = []
     if source:
         out.append(_f("critical", f"{len(source)} secret(s) in history", _secret_statement(source),

{gitmole-0.3.0 → gitmole-0.4.0}/gitmole/leaks.py

@@ -1,8 +1,8 @@
 #!/usr/bin/env python3
-"""gitleaks, with the secret values kept out of the output directory.
+"""betterleaks, with the secret values kept out of the output directory.
 
-gitmole runs this as the gitleaks step: `python3 leaks.py OUT_JSON`, from inside the repository.
-gitleaks writes its JSON report to our stdout, so the raw report is never a file; each value is
+gitmole runs this as the betterleaks step: `python3 leaks.py OUT_JSON`, from inside the repository.
+betterleaks writes its JSON report to our stdout, so the raw report is never a file; each value is
 replaced by a short keyed hash (enough to tell one value repeated in many places from many values)
 and a flag for shapes that cannot be a live secret, and only that is written. The key is random,
 made for one report and never stored, so a hash in secrets.json cannot be checked against a list of
@@ -27,8 +27,9 @@ try:
 except ImportError:  # run as a script: the package directory is sys.path[0]
     import filetypes
 
-ARGV = ["gitleaks", "git", "--no-banner", "--report-format", "json", "--report-path", "-", "--exit-code", "0"]
-RAW_FIELDS = ("Secret", "Match", "Line", "Message")   # the value, the text around it, and the commit message, which can quote it
+ARGV = ["betterleaks", "git", "--no-banner", "--report-format", "json", "--report-path", "-", "--exit-code", "0"]
+# the value, the text around it, and the commit message, which can quote it; Attributes repeats the message
+RAW_FIELDS = ("Secret", "Match", "Line", "Message", "Attributes")
 
 # A version string (5.0.0-1667386184.dfbbb54) and a token shortened with an ellipsis are the only shapes
 # skipped. Nothing is skipped by prefix: a public and a private key of the same service often share one.
@@ -102,13 +103,13 @@ def main(argv=None) -> int:
         print("usage: leaks.py OUT_JSON", file=sys.stderr)
         return 2
     target = args[0]
-    # stderr is inherited, so gitleaks' own log lands in run.log as before
+    # stderr is inherited, so betterleaks' own log lands in run.log as before
     proc = subprocess.run(ARGV, stdin=subprocess.DEVNULL, stdout=subprocess.PIPE)
     if proc.returncode != 0:
-        print(f"leaks.py: gitleaks exited {proc.returncode}; no report written", file=sys.stderr)
+        print(f"leaks.py: betterleaks exited {proc.returncode}; no report written", file=sys.stderr)
         return proc.returncode
     text = proc.stdout.decode("utf-8", "surrogateescape").strip()
-    rows = sanitise(json.loads(text) if text else [])
+    rows = sanitise((json.loads(text) if text else None) or [])   # a clean repository is reported as null
     fd, tmp = tempfile.mkstemp(dir=os.path.dirname(os.path.abspath(target)), prefix=".secrets-", suffix=".json")
     try:
         with os.fdopen(fd, "w", encoding="utf-8") as fh:

{gitmole-0.3.0 → gitmole-0.4.0}/gitmole/load.py

@@ -180,7 +180,7 @@ def parse_duplicates(text: str) -> dict:
 
 
 def parse_secrets(text: str) -> list:
-    """gitleaks rows as rule, file, short commit, line, fingerprint, the hashed value and the placeholder
+    """betterleaks rows as rule, file, short commit, line, fingerprint, the hashed value and the placeholder
     flag. A report written before values were hashed still has them: hash them here, keep nothing raw."""
     rows = json.loads(text) if text.strip() else []
     key = leaks.new_key()   # for an older report with raw values: one key per read, as the wrapper does per run

{gitmole-0.3.0 → gitmole-0.4.0}/gitmole/run.py

@@ -109,7 +109,7 @@ def env_path() -> str:
     return os.pathsep.join(parts + [os.environ.get("PATH", "")])
 
 
-REQUIRED_TOOLS = ["scc", "git-sizer", "gitleaks"]
+REQUIRED_TOOLS = ["scc", "git-sizer", "betterleaks"]
 PLOT_TOOLS = ["git-of-theseus-analyze"]
 
 
@@ -168,7 +168,7 @@ def plan(repo_dir: str, out_dir: str, branch: str = "HEAD", age: bool = True, pl
     steps = [
         {"name": "scc", "argv": ["scc", "--by-file", "--format", "json"], "stdout": o("size.json"), "deps": []},
         {"name": "git-sizer", "argv": ["git-sizer", "--verbose"], "stdout": o("repo-health.txt"), "deps": []},
-        {"name": "gitleaks", "argv": [sys.executable, LEAKS_SCRIPT, o("secrets.json")], "stdout": None, "deps": []},   # hashes the values before anything is written
+        {"name": "betterleaks", "argv": [sys.executable, LEAKS_SCRIPT, o("secrets.json")], "stdout": None, "deps": []},   # hashes the values before anything is written
         {"name": "git-log", "argv": [*filetypes.GIT, "log", "--all", "--use-mailmap", "--numstat", "--date=iso-strict", "--pretty=format:--%h--%ad--%aN--%s", "--no-renames"], "stdout": log, "deps": []},
         {"name": "change analysis", "argv": [sys.executable, MAAT_SCRIPT, log, out_dir, *type_args, *(["--now", now] if now else []), *(["--since", since] if since else []), "--aliases", o("meta.json")], "stdout": None, "deps": ["git-log"]},
     ]

{gitmole-0.3.0 → gitmole-0.4.0}/gitmole.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gitmole
-Version: 0.3.0
+Version: 0.4.0
 Summary: Offline git repository analysis with a terminal report: hotspots, coupling, ownership, code age, secrets, repo health.
 License: MIT
 Project-URL: Homepage, https://github.com/antvinni/gitmole
@@ -22,11 +22,11 @@ Dynamic: license-file
 
 # gitmole
 
-> A toolkit for digging into any cloned git repository: who works on it,
-> where the risk is, how old the code is, whether the repo itself is healthy,
-> and whether anything sensitive was ever committed.
->
-> Any stack. Free. Offline. No token. No AI. Light.
+A toolkit for digging into any cloned git repository: who works on it,
+where the risk is, how old the code is, whether the repo itself is healthy,
+and whether anything sensitive was ever committed.
+
+Any stack. Free. Offline. No token. No AI. Light.
 
 ## Principles
 
@@ -64,7 +64,7 @@ you about a clone.
 | How old is the surviving code, per year and author | gitmole's own blame pass (one `git blame` per file at HEAD) | built in |
 | Code-age and survival plots over time | [git-of-theseus](https://github.com/erikbern/git-of-theseus) | pip, opt-in with `--plots` |
 | Per-function complexity, length, parameters; duplicated blocks with `--duplicates` | [lizard](https://github.com/terryyin/lizard) | pip, installed with gitmole; tracked code files only |
-| Have secrets ever been committed | [gitleaks](https://github.com/gitleaks/gitleaks) | brew |
+| Have secrets ever been committed | [betterleaks](https://github.com/betterleaks/betterleaks) | brew |
 
 Why these and not others: [docs/tools.md](https://github.com/antvinni/gitmole/blob/main/docs/tools.md).
 
@@ -73,7 +73,7 @@ Why these and not others: [docs/tools.md](https://github.com/antvinni/gitmole/bl
 gitmole needs git, Python 3.9 or newer, and three tools on your PATH:
 [scc](https://github.com/boyter/scc) for size,
 [git-sizer](https://github.com/github/git-sizer) for repository health and
-[gitleaks](https://github.com/gitleaks/gitleaks) for secrets. gitmole itself
+[betterleaks](https://github.com/betterleaks/betterleaks) for secrets. gitmole itself
 is a Python package; install it with [pipx](https://pipx.pypa.io) so it gets
 its own environment and a `gitmole` command.
 
@@ -109,23 +109,23 @@ a static binary, so dropping it into `~/.local/bin` is enough.
 sudo apt install git git-sizer pipx
 pipx ensurepath                                  # once; then open a new shell
 
-# scc and gitleaks: one static binary each, from their release pages
-#   https://github.com/boyter/scc/releases        (the Linux x86_64 or arm64 archive)
-#   https://github.com/gitleaks/gitleaks/releases (the linux x64 or arm64 archive)
+# scc and betterleaks: one static binary each, from their release pages
+#   https://github.com/boyter/scc/releases               (the Linux x86_64 or arm64 archive)
+#   https://github.com/betterleaks/betterleaks/releases (the linux x64 or arm64 archive)
 # unpack and move the binary into ~/.local/bin, then:
-chmod +x ~/.local/bin/scc ~/.local/bin/gitleaks
+chmod +x ~/.local/bin/scc ~/.local/bin/betterleaks
 
 pipx install gitmole
 ```
 
 On a distribution without a `pipx` package, `python3 -m pip install --user
-pipx` installs it. Some distributions package scc or gitleaks as well; if
+pipx` installs it. Some distributions package scc or betterleaks as well; if
 yours does, prefer that to a downloaded binary.
 
 ### Check
 
 ```bash
-scc --version && git-sizer --version && gitleaks version && gitmole --version
+scc --version && git-sizer --version && betterleaks version && gitmole --version
 gitmole .                                        # a report of the clone you are in
 ```
 
@@ -326,8 +326,9 @@ The full report is in [docs/example.md](https://github.com/antvinni/gitmole/blob
    web pages, is a warning. Version strings and tokens shortened with "..."
    cannot be live secrets, so they are left out and counted on the footer
    line. Nothing is skipped by prefix. To silence a false positive for
-   good, copy its fingerprint from `secrets.json` into a `.gitleaksignore`
-   at the repository root; gitleaks reads it on the next run.
+   good, copy its fingerprint from `secrets.json` into a `.betterleaksignore`
+   at the repository root; betterleaks reads it on the next run, and an
+   existing `.gitleaksignore` works too.
 
    A commit counts as a fix when its subject starts with `fix:`, `hotfix:` or
    `bugfix:` in the conventional style, or mentions fix, bug, hotfix,
@@ -387,7 +388,7 @@ The files each run writes, and how to read them: [docs/output.md](https://github
 ## Development
 
 Developer setup: Homebrew for the three tools,
-`brew install scc git-sizer gitleaks`. Then either a virtual environment
+`brew install scc git-sizer betterleaks`. Then either a virtual environment
 with `pip install -e .`, or the checkout style:
 `python3 -m pip install --user rich lizard` and
 `ln -sfn "$PWD/bin/gitmole" "$(brew --prefix)/bin/gitmole"`, which makes
@@ -438,8 +439,8 @@ and `render.py` draws the report. `bin/gitmole` is a thin launcher.
 - Everything here is offline except the optional clone step, which uses
   your existing gh auth. None of the tools send data anywhere.
 - Remote targets are cloned into a fresh temp directory. Local clones are
-  only read, but the log export and the gitleaks scan touch all branches.
-- Secret values never reach the output directory. gitleaks writes its report
+  only read, but the log export and the betterleaks scan touch all branches.
+- Secret values never reach the output directory. betterleaks writes its report
   to gitmole in memory, and gitmole stores a short keyed hash of each value
   in place of the value, the matched text and the commit message. The key is
   random, made for that one report and never saved, so a stored hash cannot
@@ -459,7 +460,7 @@ separate processes. Their licences:
 |---|---|
 | scc | MIT |
 | git-sizer | MIT |
-| gitleaks | MIT |
+| betterleaks | MIT |
 | rich | MIT |
 | lizard | MIT |
 | git-of-theseus | Apache-2.0 |

{gitmole-0.3.0 → gitmole-0.4.0}/tests/test_findings.py

@@ -46,11 +46,11 @@ class SecretsFound(unittest.TestCase):
         self.assertEqual(crit["title"], "1 secret(s) in history")
         self.assertIn("1 distinct value in 2 places: generic-api-key in app/settings.py (c1, c2)", crit["detail"])
         self.assertIn("Rotate", crit["advice"])
-        self.assertIn(".gitleaksignore", crit["advice"])
+        self.assertIn(".betterleaksignore", crit["advice"])
         self.assertEqual(warn["title"], "2 secret(s) only in test files")
         self.assertIn("2 distinct values in 3 places", warn["detail"])
         self.assertIn("tests/data/a.html and 1 other file", warn["detail"])
-        self.assertIn(".gitleaksignore", warn["advice"])
+        self.assertIn(".betterleaksignore", warn["advice"])
 
     def test_test_only_secrets_do_not_fail_a_critical_gate(self):
         r = report(secrets=[self.row("h3", "tests/t.py")])

{gitmole-0.3.0 → gitmole-0.4.0}/tests/test_leaks.py

@@ -11,14 +11,15 @@ from gitmole import leaks
 
 SCRIPT = os.path.join(os.path.dirname(os.path.dirname(os.path.abspath(__file__))), "gitmole", "leaks.py")
 
-# Synthetic values only, built at runtime: a secret-shaped literal would make gitleaks, GitHub push
+# Synthetic values only, built at runtime: a secret-shaped literal would make betterleaks, GitHub push
 # protection and gitmole itself flag this file.
 FAKE = "0123456789abcdef" * 2
 VERSION = "5.0.0-" + "1667386184.dfbbb54"
 RAW = [
     {"RuleID": "generic-api-key", "File": "app/settings.py", "Commit": "c1c1c1c1c1", "StartLine": 9, "Fingerprint": "c1c1c1c1c1:app/settings.py:generic-api-key:9",
      "Secret": FAKE, "Match": f'SECRET = "{FAKE}"', "Line": f'SECRET = "{FAKE}"',
-     "Author": "Ann", "Message": f"rotate {FAKE} out of settings"},   # a message can quote the value
+     "Author": "Ann", "Message": f"rotate {FAKE} out of settings",   # a message can quote the value
+     "Attributes": {"confidence": "high", "git.message": f"rotate {FAKE} out of settings", "path": "app/settings.py"}},   # betterleaks repeats it here
     {"RuleID": "generic-api-key", "File": "web/package.json", "Commit": "d2d2d2d2d2", "StartLine": 21, "Fingerprint": "d2d2d2d2d2:web/package.json:generic-api-key:21",
      "Secret": VERSION, "Match": f'auth-next": "{VERSION}"'},
 ]
@@ -58,7 +59,7 @@ class Sanitise(unittest.TestCase):
         self.assertNotIn("0123456789abcdef", text)
         self.assertNotIn("dfbbb54", text)
         for row in rows:
-            self.assertFalse({"Secret", "Match", "Line", "Message"} & set(row), row)
+            self.assertFalse({"Secret", "Match", "Line", "Message", "Attributes"} & set(row), row)
         self.assertEqual(len(rows[0]["SecretHash"]), 12)
         again = leaks.sanitise(RAW + RAW)
         self.assertEqual(again[0]["SecretHash"], again[2]["SecretHash"], "one key per report: repeats still group")
@@ -69,7 +70,7 @@ class Sanitise(unittest.TestCase):
 
 
 class Script(unittest.TestCase):
-    """Runs the script against a stand-in gitleaks on PATH, so the wiring is tested without real keys."""
+    """Runs the script against a stand-in betterleaks on PATH, so the wiring is tested without real keys."""
 
     def _run(self, stdout: str, rc: int = 0):
         with tempfile.TemporaryDirectory() as d:
@@ -78,7 +79,7 @@ class Script(unittest.TestCase):
                 os.makedirs(p)
             with open(os.path.join(d, "stdout.json"), "w") as fh:
                 fh.write(stdout)
-            fake = os.path.join(bindir, "gitleaks")
+            fake = os.path.join(bindir, "betterleaks")
             with open(fake, "w") as fh:
                 fh.write(f"#!/bin/sh\necho \"$@\" > {d}/argv\npwd > {d}/cwd\ncat {d}/stdout.json\necho 'INF scanned' >&2\nexit {rc}\n")
             os.chmod(fake, os.stat(fake).st_mode | stat.S_IEXEC)
@@ -102,16 +103,17 @@ class Script(unittest.TestCase):
         self.assertEqual(argv[:1], ["git"])
         self.assertEqual(argv[argv.index("--report-path") + 1], "-", "the raw report must never be a file")
         self.assertEqual(argv[argv.index("--report-format") + 1], "json")
-        self.assertEqual(os.path.realpath(cwd), os.path.realpath(repo), "gitleaks scans the repository it is started in")
+        self.assertEqual(os.path.realpath(cwd), os.path.realpath(repo), "betterleaks scans the repository it is started in")
         self.assertNotIn("0123456789abcdef", written)
         self.assertEqual(len(json.loads(written)), 2)
         self.assertEqual(leftovers, ["secrets.json"], "no temporary file is left behind")
-        self.assertIn("INF scanned", p.stderr, "gitleaks' own log still reaches run.log")
+        self.assertIn("INF scanned", p.stderr, "betterleaks' own log still reaches run.log")
 
     def test_no_findings_writes_an_empty_list(self):
-        p, _, _, written, _, _ = self._run("[]")
-        self.assertEqual(p.returncode, 0, p.stderr)
-        self.assertEqual(json.loads(written), [])
+        for empty in ["[]", "null"]:   # betterleaks prints null for a clean repository
+            p, _, _, written, _, _ = self._run(empty)
+            self.assertEqual(p.returncode, 0, p.stderr)
+            self.assertEqual(json.loads(written), [], empty)
 
     def test_a_failed_scan_writes_nothing_and_fails_the_step(self):
         p, _, _, written, leftovers, _ = self._run(json.dumps(RAW), rc=2)

{gitmole-0.3.0 → gitmole-0.4.0}/tests/test_run.py

@@ -170,7 +170,7 @@ class Plan(unittest.TestCase):
     def test_lists_every_tool_and_theseus_plots_depend_on_analyze(self):
         steps = run.plan("/r", "/o")
         names = [s["name"] for s in steps]
-        for expected in ["scc", "git-sizer", "gitleaks", "git-log", "change analysis", "code age"]:
+        for expected in ["scc", "git-sizer", "betterleaks", "git-log", "change analysis", "code age"]:
             self.assertIn(expected, names)
         for gone in ["onefetch", "git-quick-stats"]:
             self.assertNotIn(gone, names)
@@ -218,13 +218,13 @@ class Plan(unittest.TestCase):
         self.assertEqual(procs_for(procs=1), "1", "a smaller count is kept")
         self.assertEqual(procs_for(), str(min(2, blame.default_procs())), "the default is clamped too")
 
-    def test_gitleaks_runs_through_the_bundled_wrapper_so_raw_secrets_never_reach_disk(self):
+    def test_betterleaks_runs_through_the_bundled_wrapper_so_raw_secrets_never_reach_disk(self):
         by = {s["name"]: s for s in run.plan("/r", "/o")}
-        argv = by["gitleaks"]["argv"]
+        argv = by["betterleaks"]["argv"]
         self.assertEqual(argv[0], sys.executable)
         self.assertTrue(argv[1].endswith("gitmole/leaks.py"), argv)
         self.assertEqual(argv[2:], ["/o/secrets.json"])
-        self.assertIsNone(by["gitleaks"]["stdout"])
+        self.assertIsNone(by["betterleaks"]["stdout"])
 
     def test_lizard_is_detected_as_a_python_module_not_a_command(self):
         self.assertNotIn("lizard", run.REQUIRED_TOOLS)
@@ -273,7 +273,7 @@ class Plan(unittest.TestCase):
 
     def test_only_three_tools_required_by_default_and_theseus_with_plots(self):
         """Checked against a directory of stub executables, not this machine's PATH."""
-        self.assertEqual(run.REQUIRED_TOOLS, ["scc", "git-sizer", "gitleaks"])
+        self.assertEqual(run.REQUIRED_TOOLS, ["scc", "git-sizer", "betterleaks"])
         with tempfile.TemporaryDirectory() as d:
             for name in run.REQUIRED_TOOLS:
                 stub = os.path.join(d, name)
@@ -285,7 +285,7 @@ class Plan(unittest.TestCase):
             open(stub, "w").close()
             os.chmod(stub, 0o755)
             self.assertEqual(run.missing_tools(plots=True, path=d), [])
-        self.assertEqual(run.missing_tools(plots=True, path="/nonexistent"), ["scc", "git-sizer", "gitleaks", "git-of-theseus-analyze"])
+        self.assertEqual(run.missing_tools(plots=True, path="/nonexistent"), ["scc", "git-sizer", "betterleaks", "git-of-theseus-analyze"])
 
     def test_theseus_tracks_the_given_branch(self):
         by = {s["name"]: s for s in run.plan("/r", "/o", branch="trunk", plots=True)}